Devices with any unauthorised change, including rooted or jailbroken devices, may never process, store or transmit CJI; when CJI is accessed directly from a device with a limited-feature operating system the agency ensures CJI moves only between authorised applications and storage areas and runs a centrally administered MDM that provides at least remote lock, remote wipe, configuration setting and locking, root and jailbreak detection, enforced folder or disk encryption, mandatory policy settings, detection of unauthorised configurations and software, device location, blocking of unpatched devices and automatic wipe after a set number of failed access attempts; an MDM is not required for CJI received from an indirect access system, which the CSO determines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.